Google Removes Chrome Extensions Injected with Malware and Ads

Google has removed two popular Chrome extensions "Add to Feedly" and "Tweet This Page" from the Chrome Web Store after they were found to have been infected with malware and adware.

Chrome extensions are small scripts of code that alter the web browser to either add new features or remove those users don't want, such as the ability to block all ads from displaying on a website.

Add to Feedly acts as a replacement for Google Reader, pulling together RSS feeds in an easy-to-read interace, while Tweet This Page shares webpages quickly on a user's Twitter account, complete with shortened URL.

Amit Agrawal, the developer of Add to Feedly, broke his silence last week, stating on his blog that he had been approached by someone over email offering "four figures" to buy his extension, which had taken him just an hour to build.

Injected

Not knowing what the buyer planned, he agreed and was paid via PayPal, transferring ownership of the extension to the new owner's Google account, but a month later he realised that the new owners had released an update of the add-on, this time injected with adverts.

"No surprises, the ratings of the extension have recently plummeted at the Chrome Store but the business model of the buyer is simple – they buy popular add-ons, inject affiliate links and the bulk of users would never notice this since the Chrome browser automatically updates add-ons in the background," writes Agrawal.

"It was probably a bad idea to sell the Chrome add-on and am sorry if you were an existing user."

Negative reviews

Both extensions, once highly-rated five stars apps, have seen their popularity sink to one star with numerous negative reviews.

Google has been aware of companies using this tactic to inject adware and malware into its extensions, and updated the Chrome Web Store policy in December 2013 to prevent developers from using multi-purpose extensions which can slow down users' computers.

Google wants developers to return to having only one "single visible UI surface" in the browser that is "easy-to-understand", i.e. not hiding other features that have been bundled together with the main extension, that run quietly in the background without users realising.

Approach

Another developer of a popular extension, Honey, which helps users to automatically find discount codes on the internet when they're about to make a purchase from an online retailer, posted on Reddit yesterday that their company had been approached numerous times by different companies hoping to buy the extension for nefarious purposes.

"Over the past year we've been approached by malware companies that have tried to buy the extension, data collection companies that have tried to buy user data, and adware companies that have tried to partner with us. We turned them all down," the developer wrote.

Honey was picked by Reddit to answer questions on privacy and security in its "I am A" section, which allows companies, news figures and celebrities to answer questions from Reddit users.